CAPTCHA smuggling

摘要: CAPTCHAs protect online resources and services from automated access. From an attacker's point of view, they are typically perceived as annoyance that prevents the mass creation accounts or posting messages. Hence, miscreants strive to effectively bypass these protection mechanisms, using techniques such optical character recognition machine learning. However, CAPTCHA systems evolve, become more resilient against analysis approaches.In this paper, we introduce evaluate attack denote smuggling. To perform smuggling, attacker slips challenges into web browsing sessions unsuspecting victims, misusing their ability solve challenges. A key our is surreptitiously injected interactions with benign applications (such mail social networking sites). As a result, normal part application raise no suspicion. Our evaluation, based on realistic user experiments, shows smuggling attacks feasible in practice.